Executive brief
Nextcloud is a collaboration platform used for file sharing and communication. A security flaw allowed any logged-in user who had permission to view at least one file comment to potentially read all comments across the entire system, including those on files they should not have access to. This could lead to the exposure of sensitive internal discussions or private information stored in file metadata.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability, classified as CWE-639, exists in the comments component of Nextcloud Server. The vulnerability stems from a missing relational check during WebDAV PROPFIND requests for file comments. An authenticated attacker with access to at least one comment could manipulate identifiers to retrieve the content of any other comment on the server. The issue affects multiple major versions of both the community and enterprise editions. Patches have been released to ensure that comment objects are properly validated against the requesting user's permissions.
Affected products
- Nextcloud Nextcloud Server 31.0.0 to 31.0.11, 32.0.0 to 32.0.2
- Nextcloud Nextcloud Enterprise Server 21.0.0 to 21.0.9.19, 22.0.0 to 22.2.10.34, 23.0.0 to 23.0.12.30, 24.0.0 to 24.0.12.29, 25.0.0 to 25.0.13.24, 26.0.0 to 26.0.13.21, 27.0.0 to 27.1.11.21, 28.0.0 to 28.0.14.12, 29.0.0 to 29.0.16.9, 30.0.0 to 30.0.17.4, 31.0.0 to 31.0.11, 32.0.0 to 32.0.2
Timeline
- 2025-12-11: patched: Initial pull requests for fixes submitted and merged into master and stable branches
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-01: disclosed: CVE published to NVD